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Using unstable particles which decay by emitting neutrinos, we propose a quantum bit commit- 
ment protocol that is humanly impossible to break. Neutrinos carry away quantum information, 
but their interaction with matter is so weak that it would take an astronomically-sized machine 
just to catch them, not to mention performing controlled unitary operations on them. As a result 
quantum information is lost, and cheating is not possible even if the participants had access to the 
most powerful quantum computers that could ever be built. Therefore, for all practical purposes, 
our new protocol is as good as unconditionally secure. 
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Bit commitment is a simple cryptographic pro- 
tocol involving two parties, customarily named Al- 
ice and Bob. Alice commits to Bob a secret bit 
b £ {0, 1} that is to be revealed at some later time. 
In order to ensure Bob that she will keep her com- 
mitment, Alice provides Bob with a piece of evidence 
with which he can verify her honesty when she un- 
veils. The security of bit commitment is an impor- 
tant issue because it can be used to implement other 
more complicated cryptographic protocols 1] . 

A bit commitment protocol is secure if it satis- 
fies the following two conditions. (1) Concealing: 
Bob cannot determine the value of h before Alice 
unveils it; (2) Binding: Alice cannot change h with- 
out Bob's knowledge. Furthermore, if the protocol 
remains secure even if Alice and Bob had capabilities 
limited only by the laws of nature (this is sometimes 
referred to as the parties having unlimited compu- 
tational power), then it is said to be unconditionally 
secure. 

Consider a simple example. Alice writes down her 
bit 6 on a piece of paper and locks it in a box, which 
she gives to Bob as evidence of her commitment. 
She unveils by announcing the value of b and giv- 
ing the key to Bob for verification. This protocol 
seems secure because Alice cannot change the bit 
without access to the box, and Bob cannot open the 
box without the key. However as with other classical 
cryptographic schemes, it is not unconditionally se- 
cure, because, e.g., Bob's ability to open the box by 
himself is not in violation of any natural laws. By 
introducing quantum mechanics into the bit com- 
mitment game, one hopes to achieve unconditional 
security which is guaranteed by the laws of nature. 
In a quantum bit commitment (QBC) protocol, Al- 



ice and Bob execute a series of quantum and clas- 
sical operations, which results in a quantum state 
with density matrix pj^ in Bob's hand. If 
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then the protocol is perfect concealing, and Bob is 
not able to extract any information about the value 
of b from pg\ That means b is encoded in the rep- 
resentation of pg\ In the unveiling phase, Alice is 
required to specify the representation so that Bob 
can check if she is honest. 

It is generally accepted that unconditionally se- 
cure quantum bit commitment is ruled out as a mat- 
ter of principle. This is due to a 1997 no-go theorem 
2^ 3} which states that, if Alice and Bob have access 
to quantum computers, then no QBC protocol can 
be concealing and binding at the same time. Fur- 
thermore, it has been shown recently that this is the 
case even if Bob employs secret parameters unknown 
to Alice 0,13. 

Given the fact that unconditionally secure QBC 
is ruled out in theory, it does not follow, however, 
that all protocols are breakable within human capa- 
bilities. This is relevant because QBC is a crypto- 
graphic task meant to be implemented in the real 
world; so if the security of a protocol is humanly 
impossible to break, then practically it is as good 
as unconditionally secure, even though it is not in 
the mathematical sense. The purpose of this paper 
is to show that the laws of physics permit a level of 
security which is not jeopardized by even the most 
powerful possible quantum computers. 

Before proceeding further, we briefly review the 
original arguments leading to the no-go result for the 
perfect concealing case |2 1^ • (For the near-perfect 

case where « p^^\ see Refs. H H 0.) The 
crucial ingredient is the observation that the whole 
commitment process, which may involve any num- 
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ber of rounds of quantum and classical exchanges 
between Alice and Bob, can be represented by an 
unitary transformation on some initial pure 

state |(/>^^)- Therefore at the end of the commit- 
ment phase, there exists a pure state 

\<'b)-^Tb\^%) (2) 

in the combined Hilbert space Ha (8) Hb of Alice and 
Bob, instead of just a mixed state in Hb- \^ab) 
is called a quantum purification of , such that 

TrA\^TB){<U-p'B\ (3) 

where the trace is over Alice's share of the state. 
In this approach, all undisclosed parameters are left 
undetermined at the quantum level. Note that the 
implementation oflA^g in general requires Alice and 
Bob to have access to quantum computers, which is 
consistent with the assumption that they have un- 
limited computational power. 

The concealing condition, Eq. flj, together with 
Schmidt decomposition theorem j^, Q| , implies that 
1^1^^) and 1^^^) can be written as 

I*ab>=E^I^a>®IV'b), (4) 

i 

I*ab> = E^I/^)®I'^b), (5) 

i 

where {|e^)}, {|/^)}, and orthonormal 
bases in Ha and Hb as indicated. Notice that l^"^^) 
and l^*^^) are identical except for the bases {|e^)} 
and { l/ji) }, which are related by an unitary operator 
Ua: 

\rA)=UA\e\). (6) 
Hence we also have 

\^Tb)=Ua\^Tb)- (7) 

It is important to note that Ua acts on Ha only so 
that Alice can implement it without Bob's help. It 
then follows that she can cheat with the following 
sure- win strategy (called EPR attack) . Alice always 
commits to 6 = in the beginning. Later on if she 
wants to keep her initial commitment, she simply 
follows the protocol honestly to the end. Otherwise 
if she wants to switch to & = 1 instead, she only 
needs to apply Ua to the qubits in her control, and 
then proceeds as if she had committed to 6 = 1 in the 
first place. Bob would conclude that Alice is honest 
in either case, because his density matrix p^^^ is not 
affected by the transformation Ua- Therefore, if a 



QBC protocol is concealing, it cannot be binding at 
the same time. 

Notice that, in the impossibility proof outlined 
above, it is implicitly assumed that Alice can main- 
tain full control over her share of the pure state 
l^fl^^) indefinitely after the end of the commitment 
phase. This is however not possible if the protocol 
involves unstable particles which can carry quantum 
information only for a finite period of time. Con- 
sider, for example, the neutron (n) which decays 
spontaneously via weak interaction (/3-decay) into 
a proton (p), an electron (e), and an anti-electron 
neutrino (ve), 

n —f p + e + De, (8) 

with a mean lifetime of r„ = 885.7 seconds y. If 
Alice is required to take certain action on a neutron, 
it is very unlikely that she could maintain full control 
over the resulting state for a period much longer 
than a few r„'s. 

One might argue that, by coherent manipulation 
of the decay products, it is still possible to control 
the spin of the neutron after it decays. This is in 
principle true. However to do so, one must be able to 
preserve the coherence between the decay products 
and the rest of the system for an indefinite length 
of time, which is practically impossible. The rea- 
son is that the wave functions of the light particles 
(e and Ve) propagate outward in all directions at 
near light-speed c, so that the volume containing 
the decay fragments increases with time as (ctY , 
which would soon encloses the entire earth. More- 
over there will be numerous neutrons decaying into 
the same volume, and one would have to be able 
to identify and manipulate the wave functions origi- 
nating from a single neutron, without disturbing the 
others. On top of this, an even more serious problem 
is that the (anti-)neutrino participates in weak inter- 
actions only. Its interaction with matter is so weak 
that a "neutrino passing through the entire earth has 
less than one chance in a thousand billion of being 
stopped by terrestrial matter" That means, on 
the one hand, the earth is not likely to cause deco- 
herence to the anti-neutrino. On the other hand, one 
would need a detector a thousand billion times the 
size of the earth just to catch a particular neutrino, 
not to mention a machine to perform controlled uni- 
tary transformations on it. And there are additional 
complications, e.^., neutrinos change identities due 
to flavor oscillations 10]. Certainly, by measuring 
the momenta of the electron and the proton, one 
could determine the momentum and spin direction 
of Ve, without actually detecting v,. itself. However 
this operation is neither controlled nor unitary, and 
hence is not useful to the cheating party. From the 
above discussion, we conclude that, for all practi- 
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cal purposes, the quantum information carried by a 
neutron is lost after it decays. 

Besides the neutron, there are many other natu- 
raUy occurring or artificial weakly decaying particles 
with different lifetimes. For example, the muon (/x) 
and the Cobalt-60 nucleus (™Co) are also unstable 
against /3-decay with mean lifetimes of 2.2 x sec- 
ond and 5.3 years ^3 respectively. 

In the QBC protocol to be proposed below, we 
shall generically call the weakly decaying particle W, 
which could be an elementary particle or atomic nu- 
cleus. The W carries spin J ^ 0, and it beta decays 
into a daughter particle w, 



W 



(9) 



with a mean lifetime tw- For simplicity, and with- 
out loss of generality, we shall take J — 1/2. As 
we shall see, the security of this protocol is guaran- 
teed by the laws of physics, independent of whether 
quantum computers are available or not. Let N be 
the security parameter, and 
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The new protocol is specified as follows. 
Commitment phase: 

1. Bob sends Alice an ordered sequence of N sta- 
ble qubits, each drawn independently from the 
set 

B = {\ + z),\~z),\+x),\~x)} (12) 
with even probability. 

2. To commit to 5 = 0, Alice keeps the stable 
qubits intact. For 6=1, she swaps the states 
of the stable qubits into N unstable PF-states, 
and measures the momentum of the electron 
emitted from each W when it decays. 

Unveiling phase: 

1. Alice unveils the value of b. For 6 = 0, she 
sends the N stable qubits back to Bob in the 
original order. For b = 1, she announces 
the electron data obtained previously from her 
measurements. To ensure the security of the 
protocol, unveiling should take place after a 
finite fraction of the W^'s has theoretically de- 
cayed. 

2. Bob verifies Alice's honesty. If 6 = 0, he checks 
if the states of the stable qubits are the same 
as before. If 6 = 1, he calculates the electron 
asymmetry using Alice's data as follows. Let 



Bi be the polarization vector of the i-th W, 
where 



Bi £ {+z, —z, +x, —x} 



(13) 



corresponding respectively to the four states in 
the set B. pi is the momentum of the electron 
emitted by the z-th W, and 



"^(ei -Pi/lPil 



(14) 



Let n(6,p) be the number of events for which 
9i = 9 and \pi\ — p, then the asymmetry 
A{9,p) is given by 

_ n{9,p)-n{n-9,p) 
"^^^'P'- ni9,p) + n{n-9,p)- ^^^> 

A{9,p) should reproduce the known experi- 
mental results for all 9 and p, otherwise Alice 
is cheating. 

Before proceeding to analyze the security of the 
protocol, let us first explain the physics behind Eq. 
(fT3|) . Consider a collection of W's polarized along 
e. Let (7 be the spin operator of the W, and p the 
electron momentum, with e • p/\p \ = cos{9). Then 
n{9,p) is a measure of the expectation value of the 
operator a ■ p in the decay process, namely. 



n{9,p) oc {(J ■ p) 



(16) 



Under parity inversion, p changes sign, but the spin 
operator a does not; hence a-p is a parity-odd (pseu- 
doscalar) operator. If parity is conserved in /3-decay, 
we must have 



which implies 



{a -p) = (a - i-p)), 



n{9,p) = n{'K — 9,p), 



(17) 



(18) 



and consequently A{9,p) = for all 9 and p. In real- 
ity, parity is maximally violated in weak interactions 
which is the underlying mechanism behind /3-decay 
[m ll^ . Hence if the data provided by Alice are 
genuine. Bob would find A{9,p) ^ 0. Otherwise, if 
she assigned the electron momentum pi randomly by 
hand, then Bob would obtain the parity conserving 
result of A{9,p^ = 0, which is a signal of cheating. 

It is trivial to prove that the protocol is conceal- 
ing. Let |<I>a/3) be the total state produced by Bob, 
where a denotes the stable qubits to be sent to AHce, 
and /3 the ancillas if any. After sending the a-sector 
to Alice, Bob's density matrix is given by 



= Trc,|$a/3)($a/3| 



(19) 
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Clearly whatever Alice does to commit, the reduced 
density matrix on Bob's side is unaffected. Hence at 
the end of the commitment phase, 



and the protocol is perfectly conceahng. 

Next we prove that it is binding. As explained 
before, the quantum information carried by a is 
practically lost after its decay. It follows that if Alice 
first commits to 6 = 1 and changes her mind after a 
finite fraction of the W^'s has decayed, her chance of 
escaping Bob's detection is exponentially small. 

The question remains, if Alice first commits to 
6 = 0, could she change to & = 1 without Bob's 
knowledge? Obviously the only way to proceed is 
to swap the states of the stable particles into un- 
stable W's, and wait for them to decay. However 
she cannot postpone her decision until the very last 
moment, because the W^s take time to decay. Sup- 
pose Bob wants to bind Alice to her commitment 
for a period no shorter than T, then the following 
arrangement is sufficient, though not unique. Bob 
instructs Alice to use a kind of unstable particles 
with mean lifetime tw = lOT, and Alice unveils 2T 
after the conclusion of the commitment procedure. 
In this situation, if Alice commits to & = 1 at the 
beginning, then by the time she unveils the average 
number of VF's decayed is given by 

dN{2T) = N{1- e~°-^). (21) 

However if she first commits to & = 0, and changes 
her mind at a time T before unveiling, then the num- 
ber of recorded decay events would be smaller: 

SN{T):^N{l~e-"-^). (22) 

That means, to unveil b = I, Alice would have to ar- 
tificially generate SN{2T) - 6N{T) « N/10 electron 
momentum data. It is important to note that these 



artificial data contribute to the denominator but not 
the numerator of Eq. H15() . As a result. Bob would 
obtain an asymmetry which is smaller than what it 
should be by a factor of 

F = SN{T) /6N{2T) w 1/2. (23) 

In an ideal world where there are no systematic er- 
rors, and statistical errors can be made as small as 
desired, a 1/2 reduction in A{d,p) is a clean and 
clear signal of cheating by Alice. One can readily 
show that, for any typical {0,p), the chance of ob- 
taining the correct A{6,p) by statistical fiuctuation 
is exponentially small for large N. This concludes 
the proof that our new protocol is secure. We em- 
phasize that it would remain secure even if Alice had 
access to the most powerful quantum computer that 
could ever be built. 

In summary, we have constructed a QBC protocol 
where some of the particles involved are unstable. 
Unstable particles can carry quantum information 
only for a finite period of time, and this property 
turns out to be useful in constructing secure QBC 
protocols. The idea is that the spontaneous decay- 
ing of the unstable particles may render the asso- 
ciated quantum information uncontrollable. If so, 
then cheating by EPR attack becomes impossible. 
In the case of any weakly decaying particles emitting 
neutrinos, controlling the decay products in a coher- 
ent manner would require an astronomically-sized 
quantum computer operating on neutrinos, which 
is clearly beyond the human capability to build. 
Therefore, for all practical purposes, our protocol 
is as good as unconditionally secure. 
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